[Paper Review] Robust GANs against Dishonest Adversaries

Zhi Xu, Chengtao Li+1 more|arXiv (Cornell University)|Feb 27, 2018

Adversarial Robustness in Machine Learning50 references3 citations

TL;DR

This paper introduces a novel notion of robustness for GANs based on adversarial perturbations to the discriminator's feedback, showing that standard GANs are highly sensitive to such noise. It derives theoretical conditions for robustness, proposes a new family of GANs inspired by WGANs with improved stability and reduced need for regularization, and validates empirically that these models are more resilient to internal feedback corruption.

ABSTRACT

Robustness of deep learning models is a property that has recently gained increasing attention. We explore a notion of robustness for generative adversarial models that is pertinent to their internal interactive structure, and show that, perhaps surprisingly, the GAN in its original form is not robust. Our notion of robustness relies on a perturbed discriminator, or noisy, adversarial interference with its feedback. We explore, theoretically and empirically, the effect of model and training properties on this robustness. In particular, we show theoretical conditions for robustness that are supported by empirical evidence. We also test the effect of regularization. Our results suggest variations of GANs that are indeed more robust to noisy attacks and have more stable training behavior, requiring less regularization in general. Inspired by our theoretical results, we further extend our framework to obtain a class of models related to WGAN, with good empirical performance. Overall, our results suggest a new perspective on understanding and designing GAN models from the viewpoint of their internal robustness.

Motivation & Objective

• To formalize a new notion of robustness in GANs based on internal adversarial interference with discriminator feedback.
• To identify theoretical conditions under which GANs become robust to such perturbations.
• To empirically validate the robustness of modified GAN architectures under noisy feedback.
• To extend the framework into a new class of WGAN-like models with better training stability and reduced regularization needs.

Proposed method

• Introduces a perturbed feedback mechanism where the generator receives corrupted signals from the discriminator with a certain probability.
• Defines a robustness criterion based on the stability of the generator's learning under such feedback perturbations.
• Derives theoretical conditions on the objective functions (via strictly increasing, odd functions in Ĥ) that ensure robustness.
• Proposes a generalized GAN framework using functions f_D and f_G from Ĥ, which includes linear and WGAN-like losses.
• Applies gradient penalty (WGAN-GP style) to the discriminator objective to enforce Lipschitz continuity.
• Employs standard training procedures with Adam optimizer and identical hyperparameters to WGAN-GP for fair empirical comparison.

Experimental results

Research questions

• RQ1 Is the original GAN architecture robust to small, adversarial perturbations in the discriminator’s feedback signal?
• RQ2 What theoretical conditions on the objective function ensure robustness against internal feedback corruption in GANs?
• RQ3 Can the theoretical robustness conditions be leveraged to design new GAN architectures with improved training stability?
• RQ4 Do models derived from the robust framework require less regularization than standard GANs?
• RQ5 How do the proposed robust GANs compare empirically to WGAN-GP and standard GANs in terms of training stability and performance?

Key findings

• The original GAN is not robust to even small perturbations in the discriminator’s feedback, leading to training failure in many cases.
• Models using linear or WGAN-like losses—specifically those with f_D and f_G in Ĥ—are theoretically and empirically more robust to feedback noise.
• The proposed robust GAN framework achieves stable training with significantly reduced need for regularization compared to standard GANs.
• Empirical results show that the proposed models achieve higher success rates in generating diverse digits (e.g., MNIST) without mode collapse.
• The addition of gradient penalty in the proposed framework maintains stability and improves performance, with inception scores increasing steadily over training iterations.
• The framework enables seamless integration with existing WGAN-GP implementations, requiring minimal code changes.